CVE-2022-31068
Assigner: GitHub_M
Published: 2022-06-28T17:50:11
State: PUBLISHED
affected: product: glpi
vendor: glpi-project
versions: status: affected
version: >=10.0.0, < 10.0.2
descriptions: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: advisory: GHSA-g4hm-6vfr-q3wg
discovery: UNKNOWN
title: Sensitive Data Exposure on Refused Inventory Files in GLPI